T07 · Tool Hijacking and Spoofing
- Location
scripts/submit_dataify_instagram_profiles.py:11- Finding
External Sibling Runtime Can Hijack Execution and Access the API Token
- Content
View full analysis
Vulnerability Details
File Location:
scripts/submit_dataify_instagram_profiles.py, lines 11–14 and 210–216
Vulnerability Type: Untrusted external module loading and tool hijacking
Risk Level: HighVulnerable Code
python TASK_RUNTIME_DIR = os.path.abspath(os.path.join(os.path.dirname(__file__), "..", "..", "dataify-task-operations", "scripts")) if TASK_RUNTIME_DIR not in sys.path: sys.path.insert(0, TASK_RUNTIME_DIR) from task_runtime import complete_taskThe imported function is subsequently given the live API token:
python if not args.no_wait: try: final_result = complete_task(task_id, api_token, args.wait_timeout) except RuntimeError as exc: print(str(exc), file=sys.stderr) return 1 print(json.dumps(final_result, ensure_ascii=False, indent=2))Technical Analysis
The script constructs a path to
../../dataify-task-operations/scripts, which is outside the audited Skill package, and inserts it at the beginning ofsys.path. It then importstask_runtimewithout validating the module's canonical path, ownership, permissions, version, or cryptographic integrity.Placing the external directory at index zero gives a
task_runtime.pyfile in that location import precedence. Python executes module-level code immediately during import, so exploitation does not require the legitimatecomplete_taskfunction to be called. Under the default wait behavior, the imported function also receives the liveDATAIFY_API_TOKENand task ID.The asynchronous monitoring functionality is related to the Skill's declared purpose, but loading executable code from a mutable sibling directory and entrusting it with a bearer token exceeds the minimum privilege required. The monitored task could instead be handled by packaged, reviewed code or a pinned and verified dependency.
Attack Path
- An attacker obtains the ability to create or modify
dataify-task-operations/scripts/task_runtime.pyin ...[truncated 1780 chars]
- An attacker obtains the ability to create or modify
- Remediation
View remediation
Remediation Suggestions
- Package the task-monitoring implementation inside the audited Skill rather than importing it from a sibling directory.
- Remove the
sys.path.insert(0, TASK_RUNTIME_DIR)modification. Use a normal package import from a trusted installation location. - If a shared runtime is required, distribute it as a pinned dependency with an exact version and integrity hash through a trusted package source.
- Before loading any external runtime, resolve its canonical path and verify that it is the expected file under an approved, non-user-writable directory.
- Verify the runtime's cryptographic digest or signature against a trusted value before import or execution.
- Apply restrictive ownership and filesystem permissions so untrusted users, Skills, and processes cannot replace the runtime.
- Avoid passing the bearer token to a broad external helper. Expose only narrowly scoped operations or perform authenticated monitoring within reviewed code.
- Consider using a short-lived, task-scoped credential for monitoring if the Dataify API supports one.
- Add automated tests that fail when
task_runtimeresolves outside the approved package and security checks that detect import-path shadowing. - Document the monitoring dependency and its trust boundary so deployment systems can validate both components together.